The Privacy Class Action Review - 2023 - Report - Page 20
financial exposure and explain the continued interest in BIPA litigation on the part of the
plaintiffs’ class action bar. The continued uncertainty of the BIPA’s parameters is likely
to continue to fuel settlement numbers over the upcoming year.
This Review analyzes the key decisions and settlements over the past year, providing
companies a one-of-its-kind resource to assess the past, present, and future of complex
privacy litigation.
A.
Illinois Supreme Court Rules On Statute Of Limitations For BIPA Violations
In one of the most highly anticipated class action rulings in years, in Tims, et al. v. Black
Horse Carriers, Inc., Case No. 127801 (Ill. Feb. 2, 2023), the Illinois Supreme Court
held that a five-year statute of limitations applies to claims under the BIPA. In March
2019, the plaintiff filed a class action complaint alleging that the defendant violated the
BIPA through its timekeeping practices that involved the scanning and storing of
employees’ fingerprints. The plaintiff asserted claims under three sub-sections of the
law, including: (1) § 15(a) of the BIPA, for failing to institute, maintain, and adhere to a
retention schedule for biometric data; (2) § 15(b) of the BIPA, which states that no
private entity may collect, capture, purchase, receive through trade, or otherwise
obtain a person’s or a customer’s biometric identifier or biometric information without
notice and consent; and (3) § 15(d) of the BIPA, which involves the unlawful disclosure
or dissemination of biometric data without first obtaining consent. Of note, § 15(c) of the
BIPA prohibits the sale of a person’s biometric data for a profit, and § 15(e) of the BIPA
imposes a duty of reasonable care in storing and protecting biometric data from
disclosure.
On September 17, 2021, the Illinois Appellate Court held that a one-year limitations
period pursuant to § 13-201 of the Illinois Code of Civil Procedure (the “Code”) governs
actions under §§ 15(c) and (d) of the BIPA, while a five-year statute of limitations
pursuant to § 13-205 applies to §§ 15(a), (b), and (e). The Illinois Appellate Court
explained that the BIPA imposes various duties that are separate and distinct from one
another. While each of the duties set forth under §§ (a)-(e) “concern privacy,” the
Appellate Court reasoned that a private entity could violate §§ (a), (b), or (e) “without
having to allege or prove that the defendant . . . published or disclosed any biometric
data.” Tims v. Black Horse Carriers, Inc., 2021 IL App (1st) 200563, at ¶ 31 (1st Dist.
Sept. 17, 2021). However, the “publication or disclosure of biometric data is clearly an
element of an action under” §§ 15(c) and (d). Id. ¶ 32. Accordingly, the Illinois Appellate
Court applied the state’s one-year statute of limitations for right of privacy claims for §§
(c) and (d), and applied the five-year “catch all” statute of limitations for §§ (a), (b), and
(e).
The Illinois Supreme Court affirmed in part and reversed in part the Illinois Appellate
Court’s decision. First, the Illinois Supreme Court notably opined that it, “agree[d] with
the parties that the [A]ppellate [C]ourt erred in applying two different statutes of
limitations to the Act.” Tims, 2023 IL 127801, at ¶ 16. It explained that one of the
purposes of a limitations period is to reduce uncertainty and create finality and
19
© Duane Morris LLP 2023
Duane Morris Privacy Class Action Review – 2023
